The final GDPR consent guidance will be published by the Information Commissioner’s Office within the next fortnight – two weeks before the May 25 D-Day – and nearly 11 months after it originally said it would be released.
While the regulator has faced criticism for a perceived “go-slow”, the ICO has actually been hamstrung by the snail-like pace of the Brussels’ decision-making machine.
The ICO released its draft consent guidance in March last year but has been waiting for the Article 29 Working Party – the body made up of the data protection chiefs of EU member states – to rubber-stamp its own guidance, which was only put out to consultation in December last year.
However, A29WP has now finally agreed the wording and, although it has been waived through with only minor amendments, an ICO spokeswoman confirmed it will take the UK regulator at least two weeks before it will complete the update of its own draft.
Information Commissioner Elizabeth Denham has consistently dismissed claims that UK firms are being held back by the delay, insisting businesses should stick to its original draft as this is unlikely to change.
One controversial proposal is the use of third-party data. Under the original plans, businesses using and managing third-party data, would only be able to do so with named companies.
At the time the draft was released, the DMA said the move would not only stifle growth, and cost the industry millions, but trigger mass redundancies across the sector. It recently reiterated these concerns, demanding answers from the ICO about how the third-party industry would be affected.
In the meantime, the DMA has just released its latest GDPR guidance which aims to clear up the confusion about whether companies can use legitimate interests or consent to process marketing data.
The “GDPR Guidance for Marketers: Consent and Legitimate Interests” has been produced with the collaboration of ISBA, the Data Protection Network and the ICO, and has used case studies already published by the DPN and the ICO in an effort to establish a consistent position on GDPR across the marketing industry.
DMA group chief executive Chris Combemale said: “Consent is one of two legal grounds likely to be used for marketing activities, alongside the equally valid legitimate interests that is still all-to-often being overlooked. In fact, it’s hard to discuss one without the other, which is why we’ve released this guidance to explain how the two can work hand in hand for marketers. Because it’s not consent or legitimate interests, it’s consent and legitimate interests.”
Related stories
DMA demands answers over threat to third-party data
ICO stands firm on ‘over strict’ GDPR consent guidance
Third-party data crackdown will wreak havoc says DMA
DPN joins calls for more urgency over GDPR guidance
UK bodies publish GDPR ‘legitimate interests’ guidance
GDPR fears mount over delay to ICO consent guidance
Industry on alert over third-party data legal crackdown
